tailscale

Commit Graph

Author	SHA1	Message	Date
James Tucker	11348fbe72	util/nocasemaps: import nocasemaps from corp This is a dependency of other code being imported later. Updates tailscale/corp#15043 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Maisem Ali	fbfee6a8c0	cmd/containerboot: use linuxfw.NetfilterRunner This migrates containerboot to reuse the NetfilterRunner used by tailscaled instead of manipulating iptables rule itself. This has the added advantage of now working with nftables and we can potentially drop the `iptables` command from the container image in the future. Updates #9310 Co-authored-by: Irbe Krumina <irbe@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Sonia Appasamy	7a0de2997e	client/web: remove unused context param from NewServer Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Maisem Ali	aad3584319	util/linuxfw: move fake runner into pkg This allows using the fake runner in different packages that need to manage filter rules. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Tom DNetto	fffafc65d6	tsnet: support registering fallback TCP flow handlers For the app connector use-case, it doesnt make sense to use listeners, because then you would need to register thousands of listeners (for each proto/service/port combo) to handle ranges. Instead, we plumb through the TCPHandlerForFlow abstraction, to avoid using the listeners abstraction that would end up being a bit messy. Signed-off-by: Tom DNetto <tom@tailscale.com> Updates: https://github.com/tailscale/corp/issues/15038	1 year ago
David Anderson	9f05018419	clientupdate/distsign: add new prod root signing key to keychain Updates tailscale/corp#15179 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Galen Guyer	04a8b8bb8e	net/dns: properly detect newer debian resolvconf Tailscale attempts to determine if resolvconf or openresolv is in use by running `resolvconf --version`, under the assumption this command will error when run with Debian's resolvconf. This assumption is no longer true and leads to the wrong commands being run on newer versions of Debian with resolvconf >= 1.90. We can now check if the returned version string starts with "Debian resolvconf" if the command is successful. Fixes #9218 Signed-off-by: Galen Guyer <galen@galenguyer.com>	1 year ago
Paul Scott	4e083e4548	util/cmpver: only consider ascii numerals (#9741 ) Fixes #9740 Signed-off-by: Paul Scott <paul@tailscale.com>	1 year ago
Maisem Ali	78a083e144	types/ipproto: drop IPProto from IPProtoVersion Based on https://github.com/golang/go/wiki/CodeReviewComments#package-names. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	05a1f5bf71	util/linuxfw: move detection logic Just a refactor to consolidate the firewall detection logic in a single package so that it can be reused in a later commit by containerboot. Updates #9310 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	56c0a75ea9	tool/gocross: handle VERSION file not found Fixes #9734 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
James Tucker	ba6ec42f6d	util/linuxfw: add missing input rule to the tailscale tun Add an explicit accept rule for input to the tun interface, as a mirror to the explicit rule to accept output from the tun interface. The rule matches any packet in to our tun interface and accepts it, and the rule is positioned and prioritized such that it should be evaluated prior to conventional ufw/iptables/nft rules. Updates #391 Fixes #7332 Updates #9084 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Andrew Lytvynov	677d486830	clientupdate: abort if current version is newer than latest (#9733 ) This is only relevant for unstable releases and local builds. When local version is newer than upstream, abort release. Also, re-add missing newlines in output that were missed in https://github.com/tailscale/tailscale/pull/9694. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Will Norris	7f08bddfe1	tailcfg: add type for web client auth response This will be returned from the upcoming control endpoints for doing web client session authentication. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Flakes Updater	00977f6de9	go.mod.sri: update SRI hash for go.mod changes Signed-off-by: Flakes Updater <noreply+flakes-updater@tailscale.com>	1 year ago
License Updater	0ccfcb515c	licenses: update tailscale{,d} licenses Signed-off-by: License Updater <noreply+license-updater@tailscale.com>	1 year ago
Brad Fitzpatrick	3749a3bbbb	go.toolchain.rev: bump for CVE-2023-39325 Updates tailscale/corp#15165 Change-Id: Ib001cfb44eb3e6d735dfece9bd3ae9eea13048c9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	6b1ed732df	go.mod: bump x/net to 0.17 for CVE-2023-39325 https://go.googlesource.com/net/+/b225e7ca6dde1ef5a5ae5ce922861bda011cfabd Updates tailscale/corp#15165 Change-Id: Ia8b5e16b1acfe1b2400d321034b41370396f70e2 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	70de16bda7	ipn/localapi: make whois take IP or IP:port as documented, fix capmap netstack lookup The whois handler was documented as taking IP (e.g. 100.101.102.103) or IP:port (e.g. usermode 127.0.0.1:1234) but that got broken at some point and we started requiring a port always. Fix that. Also, found in the process of adding tests: fix the CapMap lookup in userspace mode (it was always returning the caps of 127.0.0.1 in userspace mode). Fix and test that too. Updates #9714 Change-Id: Ie9a59744286522fa91c4b70ebe89a1e94dbded26 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Kristoffer Dalby	7f540042d5	ipn/ipnlocal: use syspolicy to determine collection of posture data Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Kristoffer Dalby	d0b8bdf8f7	posture: add get serial support for macOS Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Kristoffer Dalby	9eedf86563	posture: add get serial support for Windows/Linux This commit adds support for getting serial numbers from SMBIOS on Windows/Linux (and BSD) using go-smbios. Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Val	249edaa349	wgengine/magicsock: add probed MTU metrics Record the number of MTU probes sent, the total bytes sent, the number of times we got a successful return from an MTU probe of a particular size, and the max MTU recorded. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Val	893bdd729c	disco,net/tstun,wgengine/magicsock: probe peer MTU Automatically probe the path MTU to a peer when peer MTU is enabled, but do not use the MTU information for anything yet. Updates #311 Signed-off-by: Val <valerie@tailscale.com>	1 year ago
Kristoffer Dalby	b4e587c3bd	tailcfg,ipn: add c2n endpoint for posture identity Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Kristoffer Dalby	9593cd3871	posture: add get serial stub for all platforms Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Kristoffer Dalby	623926a25d	cmd/tailscale: add --posture-checking flag to set Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Kristoffer Dalby	886917c42b	ipn: add PostureChecks to Prefs Updates #5902 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	1 year ago
Simon Leonhardt	553f657248	sniproxy allows configuration of hostname Signed-off-by: Simon Leonhardt <simon@controlzee.com>	1 year ago
Brad Fitzpatrick	6f36f8842c	cmd/tailscale, magicsock: add debug command to flip DERP homes For testing netmap patchification server-side. Updates #1909 Change-Id: Ib1d784bd97b8d4a31e48374b4567404aae5280cc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	13767e5108	docs/sysv: add a sysv style init script The script depends on a sufficiently recent start-stop-daemon as to provide the `-m` and `--remove-pidfile` flags. Updates #9502 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Brad Fitzpatrick	f991c8a61f	tstest: make ResourceCheck panic on parallel tests To find potential flakes earlier. Updates #deflake-effort Change-Id: I52add6111d660821c3a23d4b1dd032821344bc48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
James Tucker	498f7ec663	syncs: add Map.LoadOrInit for lazily initialized values I was reviewing some code that was performing this by hand, and wanted to suggest using syncs.Map, however as the code in question was allocating a non-trivial structure this would be necessary to meet the target. Updates #cleanup Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
Joe Tsai	e4cb83b18b	taildrop: document and cleanup the package (#9699 ) Changes made: * Unexport declarations specific to internal taildrop functionality. * Document all exported functionality. * Move TestRedactErr to the taildrop package. * Rename and invert Handler.DirectFileDoFinalRename as AvoidFinalRename. Updates tailscale/corp#14772 Signed-off-by: Joe Tsai <joetsai@digital-static.net>	1 year ago
Andrew Lytvynov	e6aa7b815d	clientupdate,cmd/tailscale/cli: use cli.Stdout/Stderr (#9694 ) In case cli.Stdout/Stderr get overriden, all CLI output should use them instead of os.Stdout/Stderr. Update the `update` command to follow this pattern. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Brad Fitzpatrick	b7988b3825	api.md: remove clientConnectivity.derp field We don't actually send this. It's always been empty. Updates tailscale/corp#13400 Change-Id: I99b3d7a355fca17d2159bf81ede5be4ddd4b9dc9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Rhea Ghosh	557ddced6c	{ipn/ipnlocal, taildrop}: move put logic to taildrop (#9680 ) Cleaning up taildrop logic for sending files. Updates tailscale/corp#14772 Signed-off-by: Rhea Ghosh <rhea@tailscale.com> Co-authored-by: Joe Tsai <joetsai@digital-static.net>	1 year ago
David Anderson	c761d102ea	tool/gocross: don't absorb --tags flags passed to subcommand Fixes tailscale/corp#15117 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
Andrew Lytvynov	559f560d2d	go.toolchain.rev: bump go to 1.21.2 (#9677 ) Updates https://github.com/tailscale/go/pull/75 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Joe Tsai	c42398b5b7	ipn/ipnlocal: cleanup incomingFile (#9678 ) This is being moved to taildrop, so clean it up to stop depending on so much unreleated functionality by removing a dependency on peerAPIHandler. Updates tailscale/corp#14772 Signed-off-by: Joe Tsai <joetsai@digital-static.net> Co-authored-by: Rhea Ghosh <rhea@tailscale.com>	1 year ago
Andrew Lytvynov	3ee756757b	cmd/tailscale/cli: add update notification to "up" (#9644 ) Add available update message in "tailscale up" output. Also update the message in "tailscale status" to match and mention auto-update. Updates https://github.com/tailscale/tailscale/issues/755 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Rhea Ghosh	dc1c7cbe3e	taildrop: initial commit of taildrop functionality refactoring (#9676 ) Over time all taildrop functionality will be contained in the taildrop package. This will include end to end unit tests. This is simply the first smallest piece to move over. There is no functionality change in this commit. Updates tailscale/corp#14772 Signed-off-by: Rhea Ghosh <rhea@tailscale.com> Co-authored-by: Joseph Tsai <joetsai@tailscale.com>	1 year ago
Sonia Appasamy	3befc0ef02	client/web: restrict full management client behind browser sessions Adds `getTailscaleBrowserSession` to pull the user's session out of api requests, and `serveTailscaleAuth` to provide the "/api/auth" endpoint for browser to request auth status and new sessions. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Brad Fitzpatrick	7868393200	net/dns/resolver, ipnlocal: fix ExitDNS on Android and iOS Advertise it on Android (it looks like it already works once advertised). And both advertise & likely fix it on iOS. Yet untested. Updates #9672 Change-Id: If3b7e97f011dea61e7e75aff23dcc178b6cf9123 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	b4816e19b6	hostinfo, ipnlocal: flesh out Wake-on-LAN support, send MACs, add c2n sender This optionally uploads MAC address(es) to control, then adds a c2n handler so control can ask a node to send a WoL packet. Updates #306 RELNOTE=now supports waking up peer nodes on your LAN via Wake-on-LAN packets Change-Id: Ibea1275fcd2048dc61d7059039abfbaf1ad4f465 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Tom DNetto	da1b917575	net/tstun: finish wiring IPv6 NAT support Updates https://github.com/tailscale/corp/issues/11202 Updates ENG-991 Signed-off-by: Tom DNetto <tom@tailscale.com>	1 year ago
Brad Fitzpatrick	52e4f24c58	portlist: populate Pid field on Linux The Port.Pid was always more of an implementation detail on some platforms and isn't necessary on Linux so it was never populated. (Nothing outside the portlist package ever used it) But might as well populate it for consistency since we have it in memory and its absence confused people. Updates #cleanup Change-Id: I869768a75c9fedeff242a5452206e2b2947a17cb Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Sonia Appasamy	b29047bcf0	client/web: add browser session cache to web.Server Adds browser session cache, to be used to store sessions for the full management web client. Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	1 year ago
Brad Fitzpatrick	e499a6bae8	release/dist/unixpkgs: revert iptables move to Recommends, make it Depends Partially reverts `1bd3edbb46` (but keeps part of it) iptables is almost always required but not strictly needed. Even if you can technically run Tailscale without it (by manually configuring nftables or userspace mode), we still now mark this as "Depends" because our previous experiment in https://github.com/tailscale/tailscale/issues/9236 of making it only Recommends caused too many problems. Until our nftables table is more mature, we'd rather err on the side of wasting a little disk by including iptables for people who might not need it rather than handle reports of it being missing. Updates #9236 Change-Id: I86cc8aa3f78dafa0b4b729f55fb82eef6066be1c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Brad Fitzpatrick	93c6e1d53b	tstest/deptest: add check that x/exp/{maps,slices} imported as xfoo Updates #cleanup Change-Id: I4cbb5e477c739deddf7a46b66f286c9fdb106279 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago

... 11 12 13 14 15 ...

7082 Commits (b4b2ec780159f472af787224b7b1339ae5841346) All Branches Search

7082 Commits (b4b2ec780159f472af787224b7b1339ae5841346)

All Branches